v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the
definition the data belongs to; a restore never starts data under another version's
definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's
definition); every tier's time is its data's; the conversion-copy release needs a dump on
the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept
view joins the folder's owning group, language switch resyncs (R-691); a restore-generated
login is not shown as the password (R-694). Red-proofs in
felhom.eu/documentation/audits/version-travel-2026-09-26/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/kept_test.go

@@ -295,3 +295,27 @@ func TestKept_OwnerIsNeverTheFileBrowser(t *testing.T) {
 		t.Fatalf("the leftovers must be named by the app that binds them through HDD_PATH, never the file browser: %v", got)
 	}
 }
+
+// R-695 (v0.275.0) — an EMPTY dated kept folder (what Docker recreates when a file-browser bind outlives
+// a Delete) is never listed, so it is never bound and cannot recreate itself. A dated folder that holds
+// something is still listed.
+//
+// COMPANION RED-PROOF (REPORT.md): drop the dirHasEntries check in ListKept's dated loop — the empty
+// folder is then listed and this fails.
+func TestR695_AnEmptyDatedKeptFolderIsNeverListed(t *testing.T) {
+	m, drive := keptManager(t)
+	m.mu.Lock()
+	s := m.stacks["cloudapp"]
+	s.Deployed = true
+	s.AppConfig = &AppConfig{Deployed: true, Env: map[string]string{"HDD_PATH": drive}}
+	m.mu.Unlock()
+	empty := filepath.Join(drive, KeptDirName, "nextcloud", "2026-09-25_141014")
+	must(t, os.MkdirAll(empty, 0o755))
+	full := filepath.Join(drive, KeptDirName, "nextcloud", "2026-09-24_101010")
+	must(t, os.MkdirAll(full, 0o755))
+	must(t, os.WriteFile(filepath.Join(full, "f"), []byte("kept"), 0o644))
+	items := m.ListKept([]string{drive})
+	if len(items) != 1 || items[0].Path != full {
+		t.Fatalf("listing = %+v — want only the folder that holds something", items)
+	}
+}